Debian DSA-4590-1 : cyrus-imapd - security update

It was discovered that the lmtpd component of the Cyrus IMAP server created mailboxes with administrator privileges if the 'fileinto' was used, bypassing ACL checks. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Debian Security Advisor...

CVE-2017-18478

In cPanel before 62.0.4 incorrect ACL checks could occur in xml-api for Rearrange Account actions SEC-207...

Design/Logic Flaw

In cPanel before 62.0.4 incorrect ACL checks could occur in xml-api for Rearrange Account actions SEC-207...

CVE-2017-18478

Affected software: cPanel prior to 62.0.4. Vulnerability: incorrect ACL checks in xml-api for Rearrange Account actions, caused by an ACL bypass issue. Impact: potential improper access control. Mitigation: upgrade to 62.0.4 or later (as cited by cPanel and related CVE records). Notes: the connec...

CVE-2018-17196

A flaw was found in Apache Kafka. This flaw allows authorized clients with write permissions to manually craft a Produce request, which can bypass transaction/idempotent ACL checks...

Joomla! 3.0.x < 3.9.4 Multiple Vulnerabilities

According to its self-reported version number, the detected Joomla! application is affected by multiple vulnerabilities : - Lack of ACL checks in sample data plugins affects Joomla 3.8.0 through 3.9.3 - XSS in comconfig JSON handler affects Joomla 3.2.0 through 3.9.3 - XSS in itemtitle layout...

Design/Logic Flaw

An issue was discovered in Joomla! before 3.9.4. The sample data plugins lack ACL checks, allowing unauthorized access...

CVE-2019-9713

CVE-2019-9713 affects Joomla! before 3.9.4. The vulnerability arises from missing ACL checks in the Sample Data plugins, enabling unauthorized access. CVSSv3 base score 7.5 (NETWORK, LOW attack complexity, PR:N, UI:N, S:U, C:H, I:N, A:N); CVSSv2 base score 5.0 (AV:N/AC:L/Au:N/C:P/I:N/A:N). Implic...

[20190304] - Core - Missing ACL check in sample data plugins

The sample data plugins lack ACL checks, allowing unauthorized access...

Joomla! 2.5.x < 3.6.5 Multiple Vulnerabilities

According to its self-reported version number, the detected Joomla! application is affected by multiple vulnerabilities : - A flaw exists in the JFilterInput::isFileSafe function due to improper validation of file types and extensions of uploaded files before placing them in a user-accessible pat...

Joomla! 3.0.x < 3.6.5 Multiple Vulnerabilities

According to its self-reported version number, the detected Joomla! application is affected by multiple vulnerabilities : - A flaw exists in the JFilterInput::isFileSafe function due to improper validation of file types and extensions of uploaded files before placing them in a user-accessible pat...

Joomla! 3.2.x < 3.6.5 Multiple Vulnerabilities

According to its self-reported version number, the detected Joomla! application is affected by multiple vulnerabilities : - A flaw exists in the JFilterInput::isFileSafe function due to improper validation of file types and extensions of uploaded files before placing them in a user-accessible pat...

Design/Logic Flaw

Facebook Proxygen before 2015-11-09 mismanages HTTPMessage.request state, which allows remote attackers to conduct hijacking attacks and bypass ACL checks...

CVE-2015-7265

Facebook Proxygen before 2015-11-09 mismanages HTTPMessage.request state, which allows remote attackers to conduct hijacking attacks and bypass ACL checks...

CVE-2015-7263

The SPDY/2 codec in Facebook Proxygen before 2015-11-09 allows remote attackers to conduct hijacking attacks and bypass ACL checks via a crafted host value...

CVE-2015-7263

The SPDY/2 codec in Facebook Proxygen before 2015-11-09 allows remote attackers to conduct hijacking attacks and bypass ACL checks via a crafted host value...

CVE-2015-7265

Facebook Proxygen before 2015-11-09 mismanages HTTPMessage.request state, which allows remote attackers to conduct hijacking attacks and bypass ACL checks...

CVE-2015-7263

Facebook Proxygen’s SPDY/2 codec (pre-2015-11-09) is vended with a vulnerability that allows remote attackers to hijack sessions and bypass ACL checks by sending a crafted host value. Affected component: SPDY/2 codec in Proxygen. Underlying impact described in sources as partial integrity impact ...

CVE-2015-7265

Facebook Proxygen (C++ HTTP library) prior to 2015-11-09 is affected by CVE-2015-7265 due to mismanagement of HTTPMessage.request state. The flaw enables remote hijacking and bypass of ACL checks. Affected versions are cited in multiple sources describing this issue; exploitation details are not ...

Joomla! -- multiple vulnerabilities

The JSST and the Joomla! Security Center report: 20161201 - Core - Elevated Privileges Incorrect use of unfiltered data stored to the session on a form validation failure allows for existing user accounts to be modified; to include resetting their username, password, and user group assignments...